Teams IT Support Scams Deploy Ransomware at Scale
Researchers document hundreds of cases where threat actors pose as IT support via Microsoft Teams external chat to deliver malware and ransomware into enterprise networks.
Morgan "airgap" ReyesResearchers have documented hundreds of cases in which threat actors use Microsoft Teams’ external access feature to pose as internal IT support, gain remote access, and deliver malware or ransomware into target networks.
The Hacker News reports that researchers describe the technique as “a recurring social engineering pattern.” Teams external access is on by default in most enterprise tenants, allowing any Microsoft account holder to message internal users directly. Attackers create accounts with IT support-styled display names, contact targets with a plausible pretext (account issue, security alert, helpdesk ticket), then escalate to a remote session via QuickAssist or AnyDesk. Malware or ransomware follows.
Confidence in attribution: researchers characterize the pattern across the case set; individual operator identities are unconfirmed in the reporting.
This vector has appeared before. Operation BlueDash (July 2026) documented fake Teams IT lures deploying RMM software for persistent footholds. Teams vishing campaigns (July 2026) linked the same initial access technique to Chaos ransomware delivery across North American enterprise targets. INC and Gentlemen ransomware intrusions (October 2026) similarly relied on social engineering as initial access.
Configuration
Microsoft Teams external access is a tenant-level setting. Configuration options include restricting access to specific trusted partner domains or disabling external access entirely. These controls are documented in the Microsoft Teams admin center.
Found this useful? Share it.
